The actual requirement is narrower: enough documented information to run your processes consistently, prove conformity, and support continual improvement. Nothing more.
This article covers US-based manufacturers and service organizations operating under the certification body's applicable edition of ISO 9001. Exact documentation needs vary by company size, process complexity, product risk, customer contracts, regulatory obligations, and how much your people already know how to do without written instructions.
ISO 9001:2026 is now the current published edition, with ISO 9001:2015 withdrawn. Because detailed normative clause text for the new edition isn't yet widely published, several examples below reference the 2015 clause structure. Confirm exact wording and numbering with your certification body before finalizing any documentation matrix.
We'll walk through the difference between documents and records, the categories most organizations must maintain, Clause 7.5 controls, and a practical way to build a system an auditor can actually follow.
Key Takeaways
- ISO 9001 documentation should serve your operation, not just satisfy an auditor's checklist
- Documents explain how work gets done; records prove the work actually happened
- Some documented information is explicitly required, while the rest is your call based on process risk
- Always verify clause numbers and retention periods against your current applicable edition
- A small, controlled, searchable record system beats a massive QMS nobody follows
What ISO 9001 Requires You to Document
Maintained vs. Retained Information
ISO 9001 splits documented information into two jobs. "Maintain" means keeping a document current, like a work instruction or procedure that tells someone how to do a task today. "Retain" means preserving evidence of a past event, like a signed inspection record proving a batch shipped last March met spec.
A welding procedure is maintained. The inspection report showing a specific weld passed is retained. Mixing the two up is where a lot of QMS documentation falls apart.
Core Required Documentation
Based on ISO's documented information guidance, you need to document:
- The scope of the quality management system
- The quality policy and quality objectives
- Information needed to support process operation (procedures, criteria, specifications)
- Evidence that processes are carried out as planned
Note that the 2015 edition dropped the earlier requirement for a quality manual and six mandatory procedures. A manual can still be useful for onboarding or customer confidence, but it's a choice now, not an obligation.
Conditional Documentation
Some documentation only kicks in when a specific condition applies:
- Design and development records, when you design products or services
- Supplier evaluation criteria, when you use external providers
- Traceability information, when a customer or regulation requires it
- Monitoring and measuring equipment controls, when calibration affects conformity
Before adding anything beyond the required baseline, ask whether it:
- Helps someone do the job correctly
- Controls a real risk
- Preserves know-how that would otherwise walk out the door
- Satisfies a contractual or legal obligation
If the answer is no on all counts, skip it.
One more thing: resist the urge to grab a generic template off the internet and drop it into your QMS unchanged. Templates rarely match your actual terminology, responsibilities, or operating conditions. Auditors notice fast when a procedure describes a process your plant doesn't run.
Which ISO 9001 Records You Must Keep
Think of this as a working checklist, not a universal retention schedule. Every item needs to be checked against your clause structure and any contractual, statutory, or customer retention requirement that applies to your industry.
Leadership, Competence, and Operational Records
- Quality objectives and progress toward them
- Competence or qualification evidence for anyone doing work that affects quality
- Training effectiveness evidence, where applicable
- Calibration or verification records for monitoring and measuring equipment
- Evidence that operational processes ran as planned
Customer, Design, and Supply Chain Records
- Reviews of customer requirements and any changes to them
- Design and development inputs, reviews, verification, validation, outputs, and authorized changes (when design applies)
- Supplier evaluation, selection, and ongoing performance monitoring
- Traceability records, where required
- Lost, damaged, or unsuitable customer or supplier property incidents
Performance and Improvement Records
- Monitoring and measurement results
- Customer satisfaction evidence, where used
- Internal audit program implementation and results
- Management review outputs
- Nonconformity records and corrective action results
- Production or service release authorization
For each category, know what the record actually proves, who owns it, where it lives, and what an auditor is likely to ask for. A binder of half-completed checklists doesn't hold up long under direct questioning. One quarter's nonconformity has a way of reappearing the next if your CAPA records show "closed" without verified effectiveness.
How to Control Documentation for Audit Readiness
Clause 7.5 controls apply no matter the format: paper, spreadsheet, cloud folder, drawing, or photo. The control effort should match the risk and how the information gets used.
Creating and Updating Controlled Documents
Every controlled document needs:
- A clear identifier and title
- Revision status and date
- A named owner
- Review and approval before release
- A visible method for flagging what changed between revisions
Keeping Documents Available and Current
Current versions should sit where the work happens, not buried three folders deep on a shared drive nobody opens. Employees need to know where to look. Access should match their role: not wide open to everyone, and not locked down so tight people can't do their jobs.
Obsolete documents are a recurring audit finding. Superseded revisions need to be clearly withdrawn or marked, and customer-supplied drawings or specs need the same discipline so an outdated spec doesn't end up driving a production run.
Protecting Retained Records
Records need to survive loss, damage, unauthorized edits, and plain deterioration. A documented information register makes this manageable instead of a scramble before an audit. For each controlled item, list the owner, current revision, approval status, storage location, and retention rule.
This is the exact gap a controlled document management system is built to close. QMS Learning's Document Management System, for example, keeps one live revision visible while preserving every prior revision in an append-only trail, so a superseded version can never be mistaken for the current one.
Its clause-mapping feature links each document to the requirement, training, and related record it supports, and flags what else might need updating when a document changes. When an auditor asks for evidence, the system compiles controlled documents, revisions, and acknowledgments into one indexed export rather than a last-minute document hunt.
Software doesn't replace the responsibility piece, though. Someone still has to own each document, review it on schedule, and actually use the system day to day.
Common ISO 9001 Documentation Mistakes
Over-documentation is its own failure mode. Too many procedures, duplicate forms, and unnecessary approval chains create a maintenance burden heavy enough that employees start working around the QMS instead of through it. Document what actually controls a risk or provides required evidence. Nothing else.
Documents that don't match reality cause just as much trouble. A procedure describing an ideal process that nobody follows, an outdated work instruction, or a record filled in after the fact all tell an auditor the same thing: the paperwork and the floor aren't connected.
Involve the people doing the work when writing or reviewing documents. Watch the actual process rather than trusting the procedure on file.
According to ISOQAR's 2023 findings, the recurring audit weaknesses include:
- Multiple uncontrolled document versions in circulation
- Missing approval evidence
- Obsolete documents still being used at the workstation
- Incomplete or inaccessible records
- Unrecorded nonconformities and missing corrective action follow-through
There's also a sharp line between correcting a genuine record error through your organization's approved correction method and altering historical evidence to make a result look compliant after the fact. The first is normal quality management. The second is a falsified record, and auditors are trained to spot it.
The practical rule is simple: document what people need to do, perform the work as documented or formally update the process, and keep reliable evidence the required result actually happened.
Practical Implementation Checklist
Build your documentation system around how work actually flows, not around a folder for every clause number. ISO's process auditing guidance specifically warns against inventing processes that just mirror the standard's structure.
- Map your processes. List inputs, outputs, owners, risks, customer requirements, and the records each process generates.
- Build a clause-to-evidence matrix. Link each explicit requirement and relevant customer or regulatory obligation to the document or record that proves conformity.
- Assign ownership and location. Define access and protection controls, set retention rules based on verified obligations, and test whether someone other than the usual owner can actually retrieve the evidence.
- Train your people. Make sure they know where current documents live, how to complete records correctly, and how to flag a document that needs updating.
- Run a retrieval drill. Pull a handful of records cold, the way an auditor would, and see what breaks. A gap found internally costs a lot less than one found during a surveillance visit.
- Review after change, not just annually. Process changes, new equipment, new customer requirements, nonconformities, and standard updates are all better triggers for a documentation review than a fixed calendar date.
QMS Learning's ISO 9001 pathway builds this discipline directly into internal audit, CAPA, and management review training. People running the retrieval drill learn what a complete record looks like before an external auditor asks for one.
Conclusion
ISO 9001 documentation works when the information controls your processes and gives credible proof when someone asks for it. File count alone does not measure that.
The priority order holds up across industries: identify what's explicitly required, decide what else your QMS genuinely needs, control the current documents, protect what you've retained, and test retrieval regularly instead of assuming it works.
A team that can explain its processes and pull evidence on request walks into an audit differently than one scrambling through folders the night before. Practitioner-built training and a controlled document system close that gap by building the judgment and evidence trail auditors expect.
Frequently Asked Questions
What are the mandatory documents required by ISO 9001?
ISO 9001 requires a documented QMS scope, quality policy, and quality objectives, plus the information needed to run your processes. Design, traceability, and similar activities trigger additional mandatory documents when those processes apply.
What are the ISO guidelines for documentation?
ISO 9001 requires documented information to be suitable, available, protected, reviewed, approved, identifiable, and retrievable throughout its lifecycle. It doesn't dictate one fixed format or volume of paperwork.
What does ISO 9001 say about document control?
Clause 7.5 covers creation, review, approval, revision status, access, distribution, storage, protection, external documents, and obsolete versions. Match your control method to each document's risk and use.
What records must be retained for ISO 9001?
Retain records for competence, calibration, customer and design reviews, supplier evaluation, operational conformity, product release, nonconformity, internal audit, management review, and corrective action. Keep only those that apply to processes you actually run.
Is a quality manual required for ISO 9001?
Not under the 2015 edition, and a fixed procedure set isn't required either. Many organizations still keep a manual for QMS overview, onboarding, and showing customers how processes connect.